OTX Threat: M365 Token Spray and Replay Campaign Compromises Business Email Accounts

Between July and September 2026, a sophisticated campaign targeted Microsoft 365 accounts through adversary-in-the-middle attacks and token replay techniques. The operation captured sign-in sessions via AiTM relays and replayed stolen tokens from IP addresses controlled by German hosting provider 1337 Services GmbH. Over ten weeks, 79 organizations were compromised with 497 successful sign-ins aga